@contrast/agent 4.2.0

package/lib/reporter/translations/to-protobuf/dtm/architecture-component.js

@@ -0,0 +1,33 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const { dtm } = require('@contrast/protobuf-api');
+
+module.exports = function ArchitectureComponent({
+  type,
+  vendor,
+  url,
+  remoteHost,
+  remotePort
+} = {}) {
+  return new dtm.ArchitectureComponent({
+    0: type, //       string type = 1;
+    1: vendor, //     string vendor = 2;
+    2: url, //        string url = 3;
+    3: remoteHost, // string remote_host = 4;
+    4: remotePort //  int32 remote_port = 5;
+  });
+};

package/lib/reporter/translations/to-protobuf/dtm/attack-result.js

@@ -0,0 +1,38 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const { dtm } = require('@contrast/protobuf-api');
+
+const { mapToModelArray, resolveResponseType } = require('../../helpers');
+const RaspRuleSample = require('./rasp-rule-sample');
+
+module.exports = function AttackResult({ status, ruleId, samples = [] } = {}) {
+  const raspRuleSamples = [];
+
+  // We need to pass the ruleId along to be mapped below
+  for (const sample of samples) {
+    raspRuleSamples.push({
+      ruleId,
+      ...sample
+    });
+  }
+
+  return new dtm.AttackResult({
+    0: resolveResponseType(status), //                     1 response
+    1: ruleId, //                                          2  rule_id
+    5: mapToModelArray(RaspRuleSample, raspRuleSamples) // 6  samples
+  });
+};

package/lib/reporter/translations/to-protobuf/dtm/bot-blocker-details.js

@@ -0,0 +1,23 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+const { dtm } = require('@contrast/protobuf-api');
+
+module.exports = function BotBlockerDetails(details = {}) {
+  return new dtm.BotBlockerDetails({
+    0: details.bot,
+    1: details.userAgent
+  });
+};

package/lib/reporter/translations/to-protobuf/dtm/cmd-injection-details.js

@@ -0,0 +1,22 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+const { dtm } = require('@contrast/protobuf-api');
+
+module.exports = function CmdInjectionDetails(details = {}) {
+  return new dtm.CmdInjectionDetails({
+    0: details.command
+  });
+};

package/lib/reporter/translations/to-protobuf/dtm/cmd-injection-semantic-analysis-details.js

@@ -0,0 +1,23 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+const { dtm } = require('@contrast/protobuf-api');
+
+module.exports = function CmdInjectionSemanticAnalysisDetails(details = {}) {
+  return new dtm.CmdInjectionSemanticAnalysisDetails({
+    0: details.command,
+    1: details.findings
+  });
+};

package/lib/reporter/translations/to-protobuf/dtm/finding.js

@@ -0,0 +1,43 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const { dtm } = require('@contrast/protobuf-api');
+
+const TraceEvent = require('./trace-event');
+const { RoutesListWithObservations } = require('./route-coverage');
+const { mapToModelArray, objToMap } = require('../../helpers');
+
+module.exports = function Finding(details = {}) {
+  const { ruleId, hash } = details;
+  const preflight = ruleId && hash ? `${ruleId},${hash}` : '';
+  const props = details.properties;
+  if (props && 'lineNumber' in props) {
+    props.lineNumber = props.lineNumber.toString();
+  }
+
+  const routes = RoutesListWithObservations(details.routes);
+
+  return new dtm.Finding({
+    0: String(details.hash || ''), //                   1  hash_code
+    2: details.ruleId, //                               3    rule_id
+    5: objToMap(details.properties), //                 6 properties
+    6: mapToModelArray(TraceEvent, details.events), //  7     events
+    7: preflight, //                                    8  preflight
+    8: details.tags, //                                 9       tags
+    9: details.version, //                             10    version
+    10: routes //                                     11     routes
+  });
+};

package/lib/reporter/translations/to-protobuf/dtm/http-method-tampering-details.js

@@ -0,0 +1,24 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const { dtm } = require('@contrast/protobuf-api');
+
+module.exports = function HttpMethodTamperingDetails(details = {}) {
+  return new dtm.HttpMethodTamperingDetails({
+    0: details.method,
+    1: details.responseCode
+  });
+};

package/lib/reporter/translations/to-protobuf/dtm/http-request.js

@@ -0,0 +1,50 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const { dtm } = require('@contrast/protobuf-api');
+
+const Address = require('./address');
+const { objToMap } = require('../../helpers');
+
+const objToKeyPair = (obj = {}) =>
+  Object.keys(obj).map((key) => [key, [key, obj[key]]]);
+
+const resolveUri = (uri, queryString) =>
+  queryString ? `${uri}?${queryString}` : uri;
+
+module.exports = function HttpRequest(request = {}) {
+  // We actually prefer these values pre-toSerializable()
+  const { headers = {} } = request;
+
+  if (request.toSerializable) {
+    request = request.toSerializable();
+  }
+
+  const address = Address(request.ip, headers.host, request.port);
+
+  return new dtm.HttpRequest({
+    2: address.array, //                                   3                    sender
+    4: request.protocol, //                                5                  protocol
+    5: request.version, //                                 6                   version
+    6: request.method, //                                  7                    method
+    7: resolveUri(request.uri, request.queryString), //    8                       raw
+    15: objToKeyPair(request.parameters), //              16 normalized_request_params
+    19: objToMap(headers), //                             20           request_headers
+    29: request.body, //                                  30       parsed_request_body
+    30: !!request.body, //                                33       request_body_binary
+    49: request.serverVersionInfo //                      50                  metadata
+  });
+};

package/lib/reporter/translations/to-protobuf/dtm/index.js

@@ -0,0 +1,48 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+module.exports = {
+  Activity: require('./activity'),
+  Address: require('./address'),
+  AgentStartup: require('./agent-startup'),
+  ApplicationCreate: require('./application-create'),
+  ApplicationUpdate: require('./application-update'),
+  ArchitectureComponent: require('./architecture-component'),
+  BotBlockerDetails: require('./bot-blocker-details'),
+  CmdInjectionDetails: require('./cmd-injection-details'),
+  CmdInjectionSemanticAnalysisDetails: require('./cmd-injection-semantic-analysis-details'),
+  Finding: require('./finding'),
+  HttpMethodTamperingDetails: require('./http-method-tampering-details'),
+  HttpRequest: require('./http-request'),
+  IpBlacklistDetails: require('./ip-denylist-details'),
+  LibraryUsageUpdate: require('./library-usage-update'),
+  Poll: require('./poll'),
+  NoSqlInjectionDetails: require('./no-sql-injection-details'),
+  ObservedRoute: require('./observed-route'),
+  Pair: require('./pair'),
+  PathTraversalDetails: require('./path-traversal-details'),
+  RawRequest: require('./raw-request'),
+  RouteCoverage: require('./route-coverage'),
+  SimplePair: require('./simple-pair'),
+  SqlInjectionDetails: require('./sql-injection-details'),
+  SsjsInjectionDetails: require('./ssjs-injection-details'),
+  StackTraceElement: require('./stack-trace-element'),
+  UntrustedDeserializationDetails: require('./untrusted-deserialization-details'),
+  UserInput: require('./user-input'),
+  VirtualPatchDetails: require('./virtual-patch-details'),
+  XssDetails: require('./xss-details'),
+  XxeDetails: require('./xxe-details')
+};

package/lib/reporter/translations/to-protobuf/dtm/ip-denylist-details.js

@@ -0,0 +1,23 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+const { dtm } = require('@contrast/protobuf-api');
+
+module.exports = function IpDenylistDetails(details = {}) {
+  return new dtm.IpBlacklistDetails({
+    0: details.ip,
+    1: details.uuid
+  });
+};

package/lib/reporter/translations/to-protobuf/dtm/library-usage-update.js

@@ -0,0 +1,32 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const { dtm } = require('@contrast/protobuf-api');
+
+const mapClassNames = (classNames) =>
+  classNames.map((className) => [className, true]);
+
+module.exports = function LibraryUsageUpdate({
+  count,
+  hash,
+  classNames = []
+} = {}) {
+  return new dtm.LibraryUsageUpdate({
+    0: count, //                    int32 count = 1;
+    1: hash, //                     string hash_code = 2;
+    2: mapClassNames(classNames) // map<string, bool> class_names = 3;
+  });
+};

package/lib/reporter/translations/to-protobuf/dtm/no-sql-injection-details.js

@@ -0,0 +1,26 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+const { dtm } = require('@contrast/protobuf-api');
+
+module.exports = function NoSqlInjectionDetails(details = {}) {
+  return new dtm.NoSqlInjectionDetails({
+    0: details.start,
+    1: details.end,
+    2: details.boundaryOverrunIndex,
+    3: details.inputBoundaryIndex,
+    4: details.query
+  });
+};

package/lib/reporter/translations/to-protobuf/dtm/observed-route.js

@@ -0,0 +1,73 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const { dtm } = require('@contrast/protobuf-api');
+
+/*
+message ObservedRoute {
+    // Language specific signature of the controller method.
+    // For instance, Users#show
+    string signature = 1;
+    // The concrete, normalized URL of the request that matches this route.
+    // For instance, /users/{n}/show
+    string url = 2;
+    // The HTTP verb of this request.
+    // For instance, GET
+    string verb = 3;
+    // The ID of the current application run, as returned by the application
+    // settings endpoint or set by application.session_id.
+    string session_id = 4;
+    // The observed event sources for this route. Those that were created from
+    // untrusted inputs accessed through the Request object which corresponds
+    // to this request.
+    // For instance, type: PARAMETER, name: foo
+    repeated contrast.api.dtm.TraceEventSource sources = 5;
+}
+
+message TraceEventSource {
+    string type = 1;
+    string name = 2;
+}
+*/
+
+/**
+ * Generate an array of protobuf TraceEventSources from an array of sources
+ *
+ * @param {Object[]} sources array of source objects
+ */
+function toTraceEventSourceDtm(sources) {
+  if (!Array.isArray(sources)) {
+    return [];
+  }
+
+  // previously called dtm.TraceEventSource() and used .array - an
+  // expensive way to get the following.
+  return sources.map((tes) => [tes.type, tes.name]);
+}
+
+/**
+ * Create an ObservedRoute protobuf object
+ *
+ * @param {Object} route observation event
+ */
+module.exports = function ObservedRoute({ signature, verb, url, sources }) {
+  return new dtm.ObservedRoute({
+    0: signature, // 1 signature
+    1: url, // 2 url
+    2: verb, // 3 verb
+    4: toTraceEventSourceDtm(sources) // 4 sources
+  });
+};

package/lib/reporter/translations/to-protobuf/dtm/pair.js

@@ -0,0 +1,24 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const { dtm } = require('@contrast/protobuf-api');
+
+module.exports = function Pair({ key, values = [] } = {}) {
+  return new dtm.Pair({
+    0: key, // string key = 1; // this is the non-materialized key in the case of nested parameters
+    1: Array.isArray(values) ? values : [values] // repeated string values = 2;
+  });
+};

package/lib/reporter/translations/to-protobuf/dtm/path-traversal-details.js

@@ -0,0 +1,22 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+const { dtm } = require('@contrast/protobuf-api');
+
+module.exports = function PathTraversalDetails(details = {}) {
+  return new dtm.PathTraversalDetails({
+    0: details.path
+  });
+};

package/lib/reporter/translations/to-protobuf/dtm/poll.js

@@ -0,0 +1,19 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+const { dtm } = require('@contrast/protobuf-api');
+module.exports = function Poll() {
+  return new dtm.Poll();
+};

package/lib/reporter/translations/to-protobuf/dtm/rasp-rule-sample.js

@@ -0,0 +1,134 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const { dtm } = require('@contrast/protobuf-api');
+
+const StackTraceElement = require('./stack-trace-element');
+const UserInput = require('./user-input');
+const { mapToModelArray } = require('../../helpers');
+const {
+  RULES: {
+    BOT_BLOCKER,
+    CMD_INJECTION,
+    CMD_INJECTION_COMMAND_BACKDOORS,
+    CMD_INJECTION_SEMANTIC_CHAINED_COMMANDS,
+    CMD_INJECTION_SEMANTIC_DANGEROUS_PATHS,
+    IP_DENYLIST,
+    METHOD_TAMPERING,
+    NOSQL_INJECTION,
+    PATH_TRAVERSAL,
+    REFLECTED_XSS,
+    SQL_INJECTION,
+    SSJS_INJECTION,
+    VIRTUAL_PATCH,
+    UNTRUSTED_DESERIALIZATION,
+    XXE
+  }
+} = require('../../../../constants');
+
+const DETAILS_MAP = {
+  [BOT_BLOCKER]: {
+    index: 16,
+    Constructor: require('./bot-blocker-details')
+  },
+  [CMD_INJECTION]: {
+    index: 17,
+    Constructor: require('./cmd-injection-details')
+  },
+  [CMD_INJECTION_COMMAND_BACKDOORS]: {
+    index: 41,
+    Constructor: require('./cmd-injection-semantic-analysis-details')
+  },
+  [CMD_INJECTION_SEMANTIC_CHAINED_COMMANDS]: {
+    index: 41,
+    Constructor: require('./cmd-injection-semantic-analysis-details')
+  },
+  [CMD_INJECTION_SEMANTIC_DANGEROUS_PATHS]: {
+    index: 41,
+    Constructor: require('./cmd-injection-semantic-analysis-details')
+  },
+  [UNTRUSTED_DESERIALIZATION]: {
+    index: 20,
+    Constructor: require('./untrusted-deserialization-details')
+  },
+  [IP_DENYLIST]: {
+    index: 22,
+    Constructor: require('./ip-denylist-details')
+  },
+  [PATH_TRAVERSAL]: {
+    index: 25,
+    Constructor: require('./path-traversal-details')
+  },
+  [SQL_INJECTION]: {
+    index: 27,
+    Constructor: require('./sql-injection-details')
+  },
+  [VIRTUAL_PATCH]: {
+    index: 29,
+    Constructor: require('./virtual-patch-details')
+  },
+  [REFLECTED_XSS]: {
+    index: 30,
+    Constructor: require('./xss-details')
+  },
+  [XXE]: {
+    index: 31,
+    Constructor: require('./xxe-details')
+  },
+  [NOSQL_INJECTION]: {
+    index: 32,
+    Constructor: require('./no-sql-injection-details')
+  },
+  [METHOD_TAMPERING]: {
+    index: 33,
+    Constructor: require('./http-method-tampering-details')
+  },
+  [SSJS_INJECTION]: {
+    index: 43,
+    Constructor: require('./ssjs-injection-details')
+  }
+};
+
+const getDetails = ({ ruleId, ...details } = {}) => {
+  const array = new Array(29);
+  const lookup = DETAILS_MAP[ruleId];
+
+  if (lookup) {
+    const { index, Constructor } = lookup;
+    array[index] = new Constructor(details).array;
+  }
+
+  return array;
+};
+
+module.exports = function RaspRuleSample({
+  timestamp,
+  stack = [],
+  ruleId,
+  input,
+  details = {}
+} = {}) {
+  if (timestamp && timestamp.start) {
+    timestamp = timestamp.start;
+  }
+
+  return new dtm.RaspRuleSample({
+    1: timestamp, //                                            2         timestamp_ms
+    3: mapToModelArray(StackTraceElement, stack), //            4 stack_trace_elements
+    4: input ? new UserInput(input).array : undefined, //       5           user_input
+    ...getDetails({ ...details, ruleId }) //              17...44              details
+  });
+};